The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions specify that when running on a Codex host, the agent must request escalated sandbox permissions (require_escalated) to execute the Claude CLI. This is used to bypass default sandbox restrictions to allow the CLI to access local authentication credentials and communicate with the Anthropic API.
[COMMAND_EXECUTION]: The Antigravity (agy) reviewer component executes shell commands permitted in the user's global permissions.allow configuration. The skill documentation explicitly warns that if this list includes build or test commands, the reviewer will execute potentially untrusted code from the repository being inspected.
[INDIRECT_PROMPT_INJECTION]: The skill ingests output (review.md) from external AI agents and passes it back to the host agent as claims to be validated. This creates an indirect prompt injection surface where a compromised or malicious external reviewer could provide instructions designed to influence the host agent's subsequent actions.
[DYNAMIC_EXECUTION]: The skill includes a Python script cross_review.py that dynamically constructs and executes command-line arguments for various reviewer CLIs (Claude, Codex, Gemini) using the subprocess module. While it avoids shell=True for security, it still manages the lifecycle of these external processes.
[SAFE]: The skill implements a 'secret-hygiene' protocol that automatically excludes sensitive files—such as .env, private keys (.pem, id_rsa), and credentials—from being included in the review brief sent to external APIs.

cross-cr